1. Field of the Invention
The present invention is related to a method of analyzing log obtained by execution of program and a computer readable recording medium storing a log analysis program.
2. Description of the Related Art
In the field of software development in recent years, logs obtained by execution of a subject program are utilized in a debugging operation as to whether or not there are bugs within the subject program. To be more precise, the following debugging method using logs is widely used. Specifically, a predetermined viewer displays at least one log which includes one or a plurality of items of event information. Then, a debugging operator performs a debugging operation based on the display.
For example, one or more logs displayed by the predetermined viewer indicate a history of a series of system calls executed by an operating system (OS), or a history of a series of instances of memory access caused by operation of hardware (or an emulator). Here, an event means a change of state such as system call and memory access. The following two methods are known for the case when the debugging operator performs debugging operation based on one or more logs obtained by execution of the subject program.    (1) A debugging operator carefully investigates one log checked abnormal. Then, the debugging operator seeks a source of a bug based on the investigation.    (2) The debugging operator compares “at least one log obtained by the normal execution of a subject program” and “at least one log obtained by the abnormal execution of a subject program” and seeks a difference between “at least one log obtained by the normal execution of a subject program” and “at least one log obtained by the abnormal execution of a subject program”. Then, the debugging operator investigates the difference intensively.
In the case (1), there is no guideline showing as to which part of the log the debugging operator should investigate intensively. Accordingly, the debugging operation becomes complex as the amount of log is increases. As a result, it is difficult for an unskilled debugging operator to perform the debugging operation when the amount of the log is large.
In the case (2), the debugging operator might pay attention to a simple difference between “at least one log obtained by the normal execution of a subject program” and “at least one log obtained by the abnormal execution of a subject program”. Since there are so many points to be paid attention in such a case, the debugging operator cannot perform the debugging operation efficiently.
Accordingly, the following method which achieves enhancement of debugging efficiency, (Japanese Patent Application No. 2001-060699; Wataru Okamoto, Katsuhiko Ueki et al., “Proposal for a probe debugging method”, Technical Report of the Institute of Electronics, Information and Communication Engineers, Vol. 100, No. 186, pp 1-8 (2000-7); Wataru Okamoto et al., “Realization of a probe debugging method (1) Outlines and Evaluations”, The 62nd National Conference of Information Processing Society of Japan, 2Z-2 (2001-03); and Fumitaka Tamura et al., “Realization of a probe debugging method (2) Algorithms”),is proposed.
Specifically, for example, a log characteristic extracting device extracts a characteristic log from among a plurality of logs recording a series of events (a series of events occurring upon execution of a subject program). Then, a debugging operator preferentially investigates program codes concerning the characteristic log. In this proposal, the log characteristic extracting device extracts a log characteristic by calculating occurrence probability of each event. In this case, the log characteristic extracting device extracts the log characteristic by considering each description within the subject program and by considering an execution order of each description within the subject program.
Thereafter, the debugging operator closely investigates information concerning the event corresponding to the log characteristic. As a result, the debugging operator can perform the debugging operation of the subject program efficiently.
Meanwhile, when a given device executes the subject program, various data is read from a memory for the given device to perform a given processing. Moreover, for example, the given device can also record the various data into a built-in register as “log”. Furthermore, the given device outputs the log after execution of the subject program.
For this reason, if the log characteristic extracting device can extract a log characteristic further by considering data to be used upon execution of the subject program, then the debugging operation will become convenient in the following point. Specifically, even when the log characteristic extracting device cannot extract the log characteristic only considering “each description within the subject program” and “an execution order of each description within the subject program”, there are cases where the log characteristic extracting device is able to extract the log characteristic by considering data to be used upon execution of the subject program.
Upon extracting the log characteristic, what is important is how the log characteristic extracting device considers data to be used upon execution of the subject program. Following is a specific example. For example, code f, code g and code hare functions described within the subject program. A series of events occur as a result of execution of the subject program by the given device. Moreover, the given device records the series of events as “log”, according to an occurrence order of each event. Furthermore, for, example, the given device outputs a plurality of logs, in which the series of events are recorded according to the occurrence order, after execution of the subject program. The respective outputted logs are, for example, the following logs 1, 2 and 3:
Log 1: f(−2) g(10) h(14)
Log 2: f(11) g(15) h(18)
Log 3: f(12) g(16) h(19)
Here, each parenthesized numeral, for example, means parameter (data). In the above-described example, when the log characteristic extracting device extracts the log characteristic by considering data (parameter), the following problem exists. Specifically, even if the log characteristic extracting device calculates the occurrence probability of each event by simply comparing the logs with one another, the occurrence probabilities of the respective events become equal or close to one another. For this reason, even if the log characteristic extracting device performs an extraction operation by considering data used upon execution of the subject program, there are cases where it is difficult for the log characteristic extracting device to extract the log characteristic.
On the other hand, when the log characteristic extracting device does not perform the extraction operation by considering data used upon execution of the subject program, the following problem exists. Specifically, as in the above-described example, if the occurrence order of the respective events in each log are identical to each other(f, g, h), it is difficult for the log characteristic extracting device to extract the log characteristic. Therefore, the log characteristic extracting device needs to extract the log characteristic in appropriate consideration of data used upon execution of the subject program.
Meanwhile, the given device accesses to memory area, by executing the function described within the subject program. For this reason, if the log characteristic extracting device can extract log characteristic further by considering access to the memory area, then the debugging operation will become convenient in the following point. Specifically, even when the log characteristic extracting device cannot extract the log characteristic by considering “each description within the subject program” and “an execution order of each description within the subject program”, there are cases where the log characteristic extracting device can extract the log characteristic by appropriately considering access to the memory area.